JWT Auditor

This MCP server provides AI assistants with advanced JWT security auditing capabilities through four specialized tools for decoding, vulnerability analysis, secret brute-forcing, and token generation/editing. Built using Python with FastMCP and the cryptography library, it offers JWT header and payload decoding without verification, comprehensive vulnerability detection including algorithm confusion attacks, missing security claims, sensitive data exposure, and header injection risks, HMAC secret brute-forcing for HS256/HS384/HS512 tokens using customizable wordlists, and JWT generation with support for both symmetric (HS*) and asymmetric (RS*) algorithms. Inspired by the JWTAuditor tool, the implementation performs all operations locally without sending tokens to external services, includes built-in security checks for token lifetime analysis and replay attack detection, and supports common JWT security testing workflows, making it valuable for penetration testing, security assessments, and building AI assistants that need programmatic access to JWT analysis without manual security tool navigation.